Re: [gentoo-user] Sharing printers via Cups

[Dan Egli]

On 2/9/2021 3:20 AM, Michael wrote:
>
>> Actually tried that. Got LPD installed, sent a test page. Test page
>> appeared in the Windows Queue, then disappeared without any
>> acknowledgement from the printer.
> This would need some troubleshooting/configuring on the Windows end.  It's a
> long time ago I tried this and don't recall what I had configured to allow
> clients to print via the Windows PC.  It was relatively simple and lightweight
> though, unlike Samba which I wouldn't bother with just for printing.
If it was JUST for printing I'd agree. But the whole samba setup is for 
more than that. There's also file sharing (since Windows 10 home doesn't 
support NFS), central authentication, things like that.
>
>> I finally got it working in samba mode
>> so I'm good with that. And that, again, would skip the whole point of
>> having a central print server. :)
> Not really.  Athena would remain the CUPS server for itself and any Linux or
> additional OS clients, sending jobs over IPP:// to the Windows print server
> running on the Windows PC.
>
Okay, I could see that one. Although I'm totally lost when it comes to 
IPP. I've looked but apparently my google-fu is still weak because I 
can't find any good documentation on how to setup IPP, how to format the 
URLs, etc....
>>> 3. If the current setup is the right thing for you, increase CUPS log
>>> verbosity and check the logs on Athena to find out what it isn't happy
>>> with
>>> when Janus sends a print job to it.  First check the CUPS driver and
>>> printing protocol is the same on Janus as on Athena and the CUPS' config
>>> on Athena allows inbound connections from your LAN, or your Janus' IP
>>> address.
>> I can check on those. Thanks. I do notice one thing strange. Maybe a
>> cups bug. In the web interface when I created the printer in Athena, I
>> checked the box to say it was a shared printer. But when I look at the
>> status it says "not shared".
> Hmm ... what follows the commented line:
>
> # Restrict access to the server...
> <Location />
> Order Deny,Allow
> ... ?
>
> in the '/etc/cups/cupsd.conf' of Athena?
>

Here's the entire file. Although I fail to see what the allow/deny could 
mean for a printer showing on Athena. It's not that Janus says it's not 
a shared printer. It's ATHENA saying it's not shared, right after I 
checked the box to make it shared.

# Configuration file for the CUPS scheduler.  See "man cupsd.conf" for a
# complete description of this file.
#

# Log general information in error_log - change "warn" to "debug"
# for troubleshooting...
LogLevel debug
PageLogFormat

# Only listen for connections from the local machine.
Listen 192.168.10.2:631
Listen /run/cups/cups.sock

# Show shared printers on the local network.
Browsing On
BrowseLocalProtocols

# Default authentication type, when authentication is required...
DefaultAuthType Basic

# Web interface setting...
WebInterface Yes

# Restrict access to the server...
<Location />
   Order allow,deny
   allow 192.168.10.0/24
</Location>

# Restrict access to the admin pages...
<Location /admin>
   Order allow,deny
   allow 192.168.10.0/24
</Location>

# Restrict access to configuration files...
<Location /admin/conf>
   AuthType Default
   Require user @SYSTEM
   Order allow,deny
</Location>

# Restrict access to log files...
<Location /admin/log>
   AuthType Default
   Require user @SYSTEM
   Order allow,deny
</Location>

# Set the default printer/job policies...
<Policy default>
   # Job/subscription privacy...
   JobPrivateAccess default
   JobPrivateValues default
   SubscriptionPrivateAccess default
   SubscriptionPrivateValues default

   # Job-related operations must be done by the owner or an administrator...
   <Limit Create-Job Print-Job Print-URI Validate-Job>
     Order deny,allow
     Allow 192.168.10.0/24
   </Limit>

   <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job 
Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription 
Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job 
Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job 
CUPS-Get-Document>
     Require user @OWNER @SYSTEM
     Order deny,allow
   </Limit>

   # All administration operations require an administrator to 
authenticate...
   <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer 
CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
     AuthType Default
     Require user @SYSTEM
     Order deny,allow
   </Limit>

   # All printer operations require a printer operator to authenticate...
   <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer 
Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs 
Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer 
Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs 
CUPS-Accept-Jobs CUPS-Reject-Jobs>
     AuthType Default
     Require user @SYSTEM
     Order deny,allow
   </Limit>

   # Only the owner or an administrator can cancel or authenticate a job...
   <Limit Cancel-Job CUPS-Authenticate-Job>
     Require user @OWNER @SYSTEM
     Order deny,allow
   </Limit>

   <Limit All>
     Order deny,allow
   </Limit>
</Policy>

# Set the authenticated printer/job policies...
<Policy authenticated>
   # Job/subscription privacy...
   JobPrivateAccess default
   JobPrivateValues default
   SubscriptionPrivateAccess default
   SubscriptionPrivateValues default

   # Job-related operations must be done by the owner or an administrator...
   <Limit Create-Job Print-Job Print-URI Validate-Job>
     AuthType Default
     Order deny,allow
   </Limit>

   <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job 
Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription 
Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job 
Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job 
CUPS-Get-Document>
     AuthType Default
     Require user @OWNER @SYSTEM
     Order deny,allow
   </Limit>

   # All administration operations require an administrator to 
authenticate...
   <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer 
CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
     AuthType Default
     Require user @SYSTEM
     Order deny,allow
   </Limit>

   # All printer operations require a printer operator to authenticate...
   <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer 
Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs 
Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer 
Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs 
CUPS-Accept-Jobs CUPS-Reject-Jobs>
     AuthType Default
     Require user @SYSTEM
     Order deny,allow
   </Limit>

   # Only the owner or an administrator can cancel or authenticate a job...
   <Limit Cancel-Job CUPS-Authenticate-Job>
     AuthType Default
     Require user @OWNER @SYSTEM
     Order deny,allow
   </Limit>

   <Limit All>
     Order deny,allow
   </Limit>
</Policy>

# Set the kerberized printer/job policies...
<Policy kerberos>
   # Job/subscription privacy...
   JobPrivateAccess default
   JobPrivateValues default
   SubscriptionPrivateAccess default
   SubscriptionPrivateValues default

   # Job-related operations must be done by the owner or an administrator...
   <Limit Create-Job Print-Job Print-URI Validate-Job>
     AuthType Negotiate
     Order deny,allow
   </Limit>

   <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job 
Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription 
Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job 
Suspend-Current-Job Resume-Job Cancel-My-Jobs Close-Job CUPS-Move-Job 
CUPS-Get-Document>
     AuthType Negotiate
     Require user @OWNER @SYSTEM
     Order deny,allow
   </Limit>

   # All administration operations require an administrator to 
authenticate...
   <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer 
CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
     AuthType Default
     Require user @SYSTEM
     Order deny,allow
   </Limit>

   # All printer operations require a printer operator to authenticate...
   <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer 
Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs 
Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer 
Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs 
CUPS-Accept-Jobs CUPS-Reject-Jobs>
     AuthType Default
     Require user @SYSTEM
     Order deny,allow
   </Limit>

   # Only the owner or an administrator can cancel or authenticate a job...
   <Limit Cancel-Job CUPS-Authenticate-Job>
     AuthType Negotiate
     Require user @OWNER @SYSTEM
     Order deny,allow
   </Limit>

   <Limit All>
     Order deny,allow
   </Limit>
</Policy>

> Similarly, check the "hosts allow" directive in the Samba configuration to
> include Janus' IP address.
Again, I think you're misunderstood the problem. Forget Janus for a 
second. Forget Samba for a minute. I create a pinter via the CUPS web 
interface on Athena. When it shows the box to make it shared, I check 
the box. When I finish and the printer status appears, it says "not 
shared". Other machines and other protocols have not even come into play 
yet.

-- 
Dan Egli
On my test server